Detectionhightest
Protected Storage Service Access
Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys from Domain Controllers
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Roberto Rodriguez (Cyb3rWard0g)Created Sat Aug 10Updated Sat Nov 2745545954-4016-43c6-855e-eae8f1c369dcwindows
Log Source
Windowssecurity
ProductWindows← raw: windows
Servicesecurity← raw: security
Detection Logic
Detection Logic1 selector
detection:
selection:
EventID: 5145
ShareName|contains: 'IPC'
RelativeTargetName: 'protected_storage'
condition: selectionFalse Positives
Unknown
False positive likelihood has not been assessed. Additional context may be needed during triage.
MITRE ATT&CK
Tactics
Sub-techniques
Rule Metadata
Rule ID
45545954-4016-43c6-855e-eae8f1c369dc
Status
test
Level
high
Type
Detection
Created
Sat Aug 10
Modified
Sat Nov 27
Path
rules/windows/builtin/security/win_security_protected_storage_service_access.yml
Raw Tags
attack.lateral-movementattack.t1021.002